Privacy policy

Who is responsible

Norr Lundh Holding AB, company registration number 559412-3332, Sweden, is the controller for account administration, billing, support and service security. Contact hello@driftverk.com for privacy requests.

For personal data you put in an environment, repository, volume or snapshot, your organisation determines the purpose of processing. Where we process that data on your behalf, our Data processing agreement applies. If you use Driftverk through an employer or client, contact that organisation about its use of your data.

What we collect and why

Account and team data includes your name, email address, password hash, verification status, memberships, invitations and terms acceptance record. We use it to provide access, administer teams and document the service agreement. We rely on contract where you are a party to it, and legitimate interests in administering business customer accounts where you act for an organisation.

Security and operational data includes session identifiers, IP addresses, browser information, API access records, environment configuration, resource usage, job output and error logs. We use it to operate the service, meter usage, investigate failures and prevent abuse. Our basis is contract and our legitimate interest in securing and maintaining the service.

Billing data includes organisation and billing details, purchase records, subscriptions, usage and payment references. We use it to fulfil purchases and meet accounting obligations. Our bases are contract and legal obligation. Card payments are handled through Stripe Checkout.

When you contact us or submit an enquiry, we receive the details and message you provide. We use them to answer you, assess your request and support your organisation, on the basis of pre-contractual steps you request or our legitimate interest in responding to business enquiries.

Repositories, agents and customer infrastructure

Connecting GitHub lets us process the installation and user connection details, repository metadata and credentials needed for the access you authorise. Cloned repositories and command output may contain personal data. Avoid putting secrets or unnecessary personal data in logs.

Cloud runs environments on infrastructure supplied through Driftverk. Hybrid runs environments on infrastructure you control, while the Driftverk control plane still handles accounts, configuration, commands, operational metadata and access connections. Hybrid does not mean that no data reaches Driftverk.

You choose the agents, models and third-party services used inside your environments. Data you send to those services is subject to your arrangements with them. We do not use your repository content or environment files to train AI models.

Recipients and international transfers

We use Hetzner for hosting, Cloudflare for website and network services, Resend for transactional email and Stripe for payments. These providers receive the data needed for their services. GitHub receives requests when you connect and use its integration. Our Providers and subprocessors page describes the services they provide and the information they handle. We may also disclose information where required by law, to protect legal rights or to investigate misuse of the service.

Our providers operate internationally, and personal data may be processed outside Sweden and the European Economic Area. Transfers outside the EEA require a lawful transfer mechanism, such as an applicable European Commission adequacy decision or standard contractual clauses with any necessary supplementary safeguards. You can request information about processing locations and a copy of the applicable safeguards at hello@driftverk.com. We do not sell personal data.

How long we keep data

We retain account and team records while needed to provide and administer the service. Account closure and privacy deletion requests are handled through support. We retain billing records for the applicable statutory accounting period, and limited records needed to resolve disputes, demonstrate acceptance or prevent repeated misuse for as long as those purposes require.

Environment files, volumes and snapshots follow your deletion instructions and the service lifecycle. Stopping an environment does not delete its disk. An automatic deletion timer can remove it. Deleting an environment does not necessarily remove separately retained snapshots or volumes. Export what you need and remove those resources separately.

We determine retention for operational logs and support correspondence by the time needed to resolve the request or incident, investigate security events, and establish or defend legal claims. Records no longer needed for those purposes are deleted or anonymised. Backup copies are subject to their backup lifecycle; deleting a live record does not immediately erase every backup copy. A deletion request also covers residual copies, except where continued retention is required by law.

Cookies and local storage

The application uses authentication cookies to maintain sessions and protect access. Browser preferences may be stored locally. Blocking necessary storage may prevent sign-in or other requested features from working.

Optional analytics or advertising storage requires a separate choice before it is enabled. Accepting the service terms is not consent to tracking or marketing. Third-party pages such as payment checkout have their own privacy and cookie information.

Your choices and rights

You can ask for access, correction, erasure, restriction or portability where applicable, and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. We may need to verify your identity. Some records must be retained to meet legal obligations.

Email hello@driftverk.com. We normally respond within one month and will explain any lawful extension. You may complain to the Swedish Authority for Privacy Protection, IMY, at imy.se, or your local supervisory authority. We do not make decisions producing legal or similarly significant effects about you solely through automated processing.

Policy updates

We update this policy when our processing changes and notify affected users of material changes. The version date is shown above.